Key Takeaways
- Data brokers build profiles from public records, loyalty programs, social media, and browsing activity.
- Most consumers have never interacted with the data brokers that hold their information.
- The data broker industry generates billions of dollars annually and operates with limited federal regulation in the US.
- Some state laws, including California's CCPA, give residents the right to request deletion of their data.
- You can submit opt-out requests directly to many data brokers, though the process is often time-consuming.
Data Broker
A data broker is a company that collects personal information about individuals from a wide range of sources, packages it into detailed profiles, and sells or licenses that information to other businesses. These companies typically operate without any direct relationship with the people whose data they handle. You likely haven't heard of most of them, yet many have extensive records about you.
Data brokers are sometimes categorized by function: marketing data firms, risk mitigation firms, and people-search sites all operate under this umbrella but serve distinct markets.
Where Data Brokers Get Their Information
Data brokers pull personal information from an enormous variety of sources, and the breadth of what they collect may be surprising. The pipeline typically includes:
- Public records: Property deeds, voter registrations, court filings, marriage and divorce records, and business licenses are all publicly accessible and routinely harvested.
- Commercial transactions: Loyalty card programs, retail purchase histories, subscription sign-ups, and warranty registrations feed detailed consumer behavior records into broker databases.
- Online activity: Browsing data, app usage, and location signals collected through tracking technologies contribute behavioral and interest profiles. For a closer look at how this happens at the browser level, see what your browser actually knows about you.
- Social media and public profiles: Information voluntarily posted on public-facing profiles is regularly ingested by data collection pipelines.
- Third-party data resellers: Brokers also buy data from other brokers, so the same information can move through multiple hands before reaching its final buyer.
Understanding the vocabulary behind these practices can help. Terms like cookies, trackers, and metadata are foundational — our guide to key online privacy terms covers these clearly.
$350B+
Estimated annual US data broker industry revenue
The data brokerage sector is a multi-hundred-billion-dollar industry, according to estimates from privacy research organizations and market analysts.
4,000+
Estimated number of active data broker companies
Privacy advocacy groups estimate that thousands of distinct data broker firms operate in the US, ranging from large public companies to small specialized resellers.
1 in 4
Americans aware of data broker industry existence
Consumer surveys have consistently found that a large share of the US public has little to no awareness that the data broker industry exists or holds records on them.
What Happens to Your Profile — and Who Buys It
Once assembled, a data broker's profile on an individual can include name, address history, estimated income, household composition, health interests, political affiliation, purchasing habits, and more. These profiles are not static — they are continuously updated as new data becomes available.
The buyers of this data span a wide range of industries. Advertisers use it to target campaigns. Insurance companies may use it to inform underwriting. Employers and landlords may access it for screening. Political organizations use it to micro-target messaging. Law enforcement agencies have also been documented as data broker customers, a practice that has drawn significant scrutiny.
The key dynamic to understand is that you are rarely the customer in this system — you are the product. The relationship runs between the data broker and whatever entity is willing to pay for access to profiles like yours.
The Regulatory Landscape in the United States
At the federal level, the US does not have a single comprehensive privacy law governing data brokers. Sector-specific rules — such as HIPAA for health data and FCRA for credit information — apply in narrow contexts, but the broader data broker industry operates in a largely permissive regulatory environment.
State-level laws have moved faster. California's Consumer Privacy Act (CCPA) and its subsequent amendment, the CPRA, give California residents rights to know what data is held about them, request deletion, and opt out of certain types of data sales. Vermont requires data brokers to register with the state. Other states have passed or are considering similar measures.
State Laws Vary Significantly
Data privacy rights are not uniform across the United States. Whether you have the right to request deletion of your data or opt out of its sale depends heavily on the state in which you live. Checking your own state's attorney general website is a reliable way to understand what protections currently apply to you.
If you want to understand what rights you may already have, a plain-language overview of data rights explains the general framework.
What You Can Do About It
Eliminating your presence from data broker databases entirely is not realistic for most people. But there are meaningful steps you can take to reduce your exposure.
- Submit opt-out requests: Many of the largest data brokers — particularly people-search sites — maintain opt-out processes. These vary in complexity, but they are generally free.
- Limit data at the source: Be selective about loyalty programs, app permissions, and what personal information you share in online forms. Deliberate habits around what you disclose online matter — thoughtful habits for sharing personal information online offers practical guidance.
- Review privacy settings regularly: Social media platforms and apps periodically change their default settings. Periodic audits of what you've permitted are worthwhile.
Data privacy is not an all-or-nothing proposition. Even incremental steps — opting out of a few high-volume brokers, tightening app permissions — meaningfully reduce the breadth of the profiles that can be built about you.
Start With People-Search Sites
People-search sites — those that display home addresses, relatives, and phone numbers — are among the most visible data broker products. Many have self-service opt-out forms that take only a few minutes per site. Starting with these is a practical first step that yields tangible results without requiring technical expertise.